4 ms·
Why is mongodb seem to show up alot with this. Does their default set up hide some unsecured users? Its been a while but I dont remember that being in there.
by nautilus12 6y ago
Why is mongodb seem to show up alot with this. Does their default set up hide some unsecured users? Its been a while but I dont remember that being in there.
- akx 6y agoNo, their default sets up no authentication at all IIRC. Combined with Dockerized installations punching through some firewall setups (as discussed elsewhere), you'll get meowed.
- achillean 6y agoBy default though, MongoDB will only listen on localhost and I believe it'll show you a big warning on boot up if you don't have authentication configured. They used to listen on 0.0.0.0 by default but that was fixed many years ago. And this issue doesn't just affect MongoDB - imo since the "webscale" days it's been a favorite to knock on but the public exposure of data happens across many technologies. Here's a comparison with a few others: https://blog.shodan.io/elastic-data-exposure-grows-to-3-2-pb/ https://blog.shodan.io/elastic-data-exposure-grows-to-3-2-pb...